It's hard to know how someone gained access to your server without having access to your vBulletin forum/logs.

Anything is possible such as: shared webhost breach, insecure vBulletin plugins, bad vBulletin configuration, other vulnerable software hosted on the server, etc.

You could start out by posting all of your plugins here.

i contact my server, don`t have any log hack .. they said hack from script, not from sever attack

this my plugin

1. Adam's Subscribed Thread Notifications
2. Advanced Application Forms (INACTIVE)
3. BT - Social Group Message Quote
4. Change Posts Owner
5. Chip2love.9xpro - Limit new thread/post per day
6. First Post on all pages (INACTIVE)
7. Forum Category Icons (Advanced)
8. Forum Runner (INACTIVE)
9. GeekyDesigns Default Avatar
10. Global Threads: The Next Generation FREE by BOP5
11. GlowHost - Spam-O-Matic
12. Helpful Answers (INACTIVE)
13. iTrader (INACTIVE)
14. Limit Posts Per Day in Threads by BOP5
15. Make Prefixes Clickable to Filter Forumdisplay
16. Mark Thread As 'Sold'
17. Minimum Post Count Required To Post Blog Entries
18. Mod-Mall BB Code Spoiler
19. More Share Options for VB4 by BOP5 Light (INACTIVE)
20. Nested Quotes
21. Advanced User Tagging (DBTech)
22. DBSeo (DBTech) (INACTIVE)
23. Panjo (INACTIVE)
24. PB Usergroup Choice on Registration (INACTIVE)
25. Ajax Point System
26. PostRelease (INACTIVE)
27. ProvB - Extra Threadfields
28. Rotating Banner System
29. Skimlinks Plugin (INACTIVE)
30. Subscription Notification System
31. Tapatalk (INACTIVE)
32. Thread Participants - by rellect
33. Threads Started by User in Postbit & Profile
34. User Article Count (INACTIVE)
35. Usergroup Allow HTML
36. vBadvanced CMPS
37. vBulletin Blog (INACTIVE)
38. vBulletin CMS (INACTIVE)
39. vFcoders - Ajax First Post Collapsable Hack (INACTIVE)
40. View your Threads or Posts from the Navbar
41. VSa - Sub-Forum Manager (INACTIVE)
42. WS vBulletin Tweet Poster
43. XenForo Style Avatars
44. [OzzModz] Exclude Forums From Activity Stream (INACTIVE)

Do you have anything listed under ACP --> Plugins & Products --> Plugin Manager in the group Product : vBulletin

yes.. only my custom mod

Check the FG, FGD, ghj and Lintas Agama Terbaru plugins because they have suspicious names which I never heard of. If unsure, post the contents of the plugins here.

that plugin its my make with unique name ..

Have you overwritten the files with the vBulletin files downloaded from the members area? This is what you need to do to get rid of this problem for now. To my knowledge there is no vblogin.php file in the official download, its called login.php if I remember correctly. So as said before they modified this to use that file.

To find how they got in is a different matter. If you are running your forum on a shared server then that is more and likely how. Shared servers and just that...shared and less secure than a VPS or dedicated server. You can try and speak with your web host and see if they have any way to tell where the attack came from. Most likely the hacker gained access to your FTP and changed/uploaded files to your site.

Are you using any nulled plug ins? The nulled plug ins for Dbtech seo are known to do this. Be sure all your plug ins are licensed and up to date and that your file permissions are correct. Also that you have the latest patch for your Vbulletin version.

Once you find the hole you will need to change all server log ins, ftp, mysql, etc and admin logs.

I saw the name Plum, he's one of the known powersurge hackers.

- You could have been hacked into long ago, spare admin accounts present?
- Even if you have disabled a mod/plugin the files still have the vulnerabilities present so m,ods such as Tapatalk which had a recent security exploit found should always be updated to the most secure version or removed entirely.
- Do as HM666 mentioned and overwrite all files, after that review the back-end and see if there's any spare admin accounts (use usergroup manager check for accounts w/ secondary usergroups assigned as well) and then check the plugins via the plugin manager as they can edit plugins after gaining access then finally check all files that were not overwritten and do not skip checking your attachments folder if stored in filesystem I've seen them hide files there too.

You wrote it/them? If so check them again and be sure you coded them properly otherwise you could have a plethora of security issues that we'll never be aware of or able to offer assistance with and no do not post your code, if its a private mod/plugin all the better since code is not known I would review with another fellow coder or ask for assistance in the Private Coders Discussion forum.